To prevent GUI lockout due to unavailable remote authentication server, the system
has a default fallback to the local database. In case of 2FA for the GUI one needs
to disable the fallback option to make sure no local user can gain access without 2FA.

OPNsense fully supports the use of Google’s Authenticator application.
This application can generate tokens on Android, iOS and BlackBerry OS.
The usage of this application is free and very simple to setup using OPNsense.